github.com/caddyserver/caddy vulnerabilities
CVEs whose affected-version data names the github.com/caddyserver/caddy package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-52844High· 7.5Caddy: Windows `file_server` path authorization bypass via encoded backslash
Caddy: Windows `file_server` path authorization bypass via encoded backslash
▾ Twilightcaddyserver · github.com/caddyserver/caddy/v2EPSS 0.62%via GHSA
CVE-2026-52845High· 8.1Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
▾ Twilightcaddyserver · github.com/caddyserver/caddy/v2EPSS 0.29%via GHSA
CVE-2026-52846Medium· 4.2Caddy: stripHTML template function bypass
Caddy: stripHTML template function bypass
▾ Sunlitcaddyserver · github.com/caddyserver/caddy/v2EPSS 0.19%via GHSA
CVE-2022-29718Medium· 6.1Open redirect in caddy
Open redirect in caddy
▾ Sunlitcaddyserver · github.com/caddyserver/caddyEPSS 1.0%via OSV